JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.122.91.104

103.122.91.104 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 53%: ?

53%

ISP	Asia Pacific Network Information Centre
Usage Type	Fixed Line ISP
ASN	AS136009
Domain Name	apnic.net
Country	🇧🇩 Bangladesh
City	Dhaka, Dhaka Division

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.122.91.104

Whois 103.122.91.104

IP Abuse Reports for 103.122.91.104:

This IP address has been reported a total of 25 times from 17 distinct sources. 103.122.91.104 was first reported on November 5th 2023, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Vegascosmetics	2026-07-24 15:46:47 (21 hours ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: DEEP ATTACK: Recursive currentUrl nesting detected show less	Hacking Exploited Host Web App Attack
🇨🇿 ptlab	2026-07-23 14:45:08 (1 day ago)	Detected wp_admin attack from WP-host.	Hacking Web App Attack
🇷🇸 Scan	2026-07-22 03:30:27 (3 days ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-07-19 14:40:26 (5 days ago)	(mod_security) mod_security (id:210730) triggered by 103.122.91.104 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 103.122.91.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 10:40:19.110790 2026] [security2:error] [pid 17134:tid 17134] [client 103.122.91.104:40776] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.ilikeabe.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ilikeabe.com"] [uri "/michleencollins.com"] [unique_id "alzh0wM3mjxOEYTLTyDwzQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-07-18 20:39:00 (6 days ago)	IPBlock protected site ID [4055-d][s=03]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇳🇱 DrLex0	2026-07-15 01:38:59 (1 week ago)	BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being ... show more BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being a burning bag of dog poop. 103.122.91.104 443 - [15/Jul/2026:01:38:59 +0000] "GET [redacted] HTTP/1.1" 503 6147 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0" show less	Bad Web Bot Exploited Host
🇺🇸 kosada.com	2026-07-12 07:39:10 (1 week ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-07-07 17:47:17 (2 weeks ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Excessive filters used: /catalogsearch/result/?cat=33&product_vc_mcu=105&product_vc_type=101&q=ex+90&screensize=24%2C46%2C336 \| UA: Mozilla/5.0 (Windows 95) AppleWebKit/536.0 (KHTML, like Gecko) Chrome/16.0.866.0 Safari/536.0 \| (Magento Site) show less	Hacking Bad Web Bot
Anonymous	2026-07-05 18:26:32 (2 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 kosada.com	2026-06-29 10:24:06 (3 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-06-28 06:39:31 (3 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-06-07 19:23:32 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 103.122.91.104 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 103.122.91.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 15:23:26.525738 2026] [security2:error] [pid 1429:tid 1429] [client 103.122.91.104:5032] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.raintechgutters.com\|F\|2"] [data ".raintechgutters.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.raintechgutters.com"] [uri "/gutter-repair-orlando-fl/ www.raintechgutters.com"] [unique_id "aiXFLpKGZy8Tn4tBG_67fgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 A000Z	2026-03-19 04:35:23 (4 months ago)	Fail2Ban: 103.122.91.104 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5 ... show more Fail2Ban: 103.122.91.104 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 show less	Bad Web Bot
🇮🇹 VHosting	2025-11-25 10:26:06 (8 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
Anonymous	2025-11-21 10:47:39 (8 months ago)	scanning http requests from known botnet	Web App Attack

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 188.254.76.32

🇨🇦 142.44.149.52

🇫🇷 137.74.114.131

🇮🇳 122.183.50.60

🇰🇷 61.76.221.51

🇸🇬 8.219.170.229

🇷🇺 5.141.192.160

🇹🇭 203.154.158.195

🇨🇦 199.204.72.146

🇳🇱 193.176.31.203

🇺🇸 192.163.244.125

🇺🇸 192.159.99.144

🇺🇸 172.67.170.129

🇹🇭 118.27.147.93

🇰🇪 102.204.199.201

🇿🇲 102.23.122.235

🇺🇸 66.132.224.81

🇳🇱 45.148.10.152

🇬🇧 35.203.211.171

🇹🇼 27.147.13.67